IndicatorPublished 1 Jul 2026

Malicious SHA-256 file hash 93e71b122a43… (OffSeq Mirage)

Source OffSeq Mirage · Featured honeypot telemetry (opens in a new tab)

Indicators of compromise

Hashes 1

OffSeq Mirage — a malicious file, observed 2026-07-01..2026-07-01, 2×

93e71b122a432c2b7acf6a5db6ee3e42e792ef240acee466c4310b052e2416db

Description

OffSeq Mirage honeypot sensors observed this SHA-256 file hash 2 time(s) in attacker activity between 2026-07-01 and 2026-07-01. Observed technique: T1105 (Ingress Tool Transfer). Seen from attacker infrastructure in PL. File hashes fingerprint a specific malicious payload (a dropper, web shell, miner, or post-exploitation tool) that was staged or delivered during the attack. Match it against files in your environment and your EDR/AV and threat-intel feeds.

Impact

The presence of this malicious file hash indicates potential compromise involving the transfer of a malicious payload that could facilitate further malicious actions such as persistence, data theft, or resource abuse. However, no active exploitation campaigns or direct impacts on specific software products are reported. The impact depends on whether the file is found and executed within an environment.

Defensive guidance

Security teams should match this SHA-256 hash against files in their environments, endpoint detection and response (EDR), antivirus (AV), and threat intelligence feeds to detect and respond to potential infections. Monitoring for the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) may also help identify related attacker activity. There is no vendor advisory or patch available for this threat.

References

mirage.offseq.com (opens in a new tab)

Community reviews

Loading reviews…

Indicators of compromise

Hashes 1

Description

AI analysisMachine-generated, updated 1 Jul 2026, 14:36 UTC

MITRE ATT&CK techniques1 from threat tags

Technical details

References

Community reviews

Related threats